\subsubsection{\NonOptimizingKeilVI (\ThumbMode)}

Let's compile the same example using Keil in Thumb mode:

\begin{lstlisting}
armcc.exe --thumb --c90 -O0 1.c 
\end{lstlisting}

We are getting (in \IDA):

\begin{lstlisting}[caption=\NonOptimizingKeilVI (\ThumbMode) + \IDA,style=customasmARM]
.text:00000000             main
.text:00000000 10 B5          PUSH    {R4,LR}
.text:00000002 C0 A0          ADR     R0, aHelloWorld ; "hello, world"
.text:00000004 06 F0 2E F9    BL      __2printf
.text:00000008 00 20          MOVS    R0, #0
.text:0000000A 10 BD          POP     {R4,PC}

.text:00000304 68 65 6C 6C+aHelloWorld  DCB "hello, world",0    ; DATA XREF: main+2
\end{lstlisting}

We can easily spot the 2-byte (16-bit) opcodes. This is, as was already noted, Thumb.
\myindex{ARM!\Instructions!BL}
The \TT{BL} instruction, however, consists of two 16-bit instructions.
This is because it is impossible to load an offset for the \printf function while using the small space in one 16-bit opcode.
Therefore, the first 16-bit instruction loads the higher 10 bits of the offset and the second instruction loads 
the lower 11 bits of the offset.

% TODO:
% BL has space for 11 bits, so if we don't encode the lowest bit,
% then we should get 11 bits for the upper half, and 12 bits for the lower half.
% And the highest bit encodes the sign, so the destination has to be within
% \pm 4M of current_PC.
% This may be less if adding the lower half does not carry over,
% but I'm not sure --all my programs have 0 for the upper half,
% and don't carry over for the lower half.
% It would be interesting to check where __2printf is located relative to 0x8
% (I think the program counter is the next instruction on a multiple of 4
% for THUMB).
% The lower 11 bytes of the BL instructions and the even bit are
% 000 0000 0110 | 001 0010 1110 0 = 000 0000 0110 0010 0101 1100 = 0x00625c,
% so __2printf should be at 0x006264.
% But if we only have 10 and 11 bits, then the offset would be:
% 00 0000 0110 | 01 0010 1110 0 = 0 0000 0011 0010 0101 1100 = 0x00325c,
% so __2printf should be at 0x003264.
% In this case, though, the new program counter can only be 1M away,
% because of the highest bit is used for the sign.

As was noted, all instructions in Thumb mode have a size of 2 bytes (or 16 bits).
This implies it is impossible for a Thumb-instruction to be at an odd address whatsoever.
Given the above, the last address bit may be omitted while encoding instructions.

In summary, the \TT{BL} Thumb-instruction can encode an address in $current\_PC \pm{}\approx{}2M$.

\myindex{ARM!\Instructions!PUSH}
\myindex{ARM!\Instructions!POP}
As for the other instructions in the function: \PUSH and \POP work here just like the described \TT{STMFD}/\TT{LDMFD} only the \ac{SP} register is not mentioned explicitly here.
\TT{ADR} works just like in the previous example.
\TT{MOVS} writes 0 into the \Reg{0} register in order to return zero.

